Photon-number-splitting versus cloning attacks in practical implementations of the Bennett-Brassard 1984 protocol for quantum cryptography

Article

Reference

Photon-number-splitting versus cloning attacks in practical implementations of the Bennett-Brassard 1984 protocol for quantum

cryptography

NIEDERBERGER, Armand, SCARANI, Valerio, GISIN, Nicolas

Abstract

In practical quantum cryptography, the source sometimes produces multi-photon pulses, thus enabling the eavesdropper Eve to perform the powerful photon-number-splitting (PNS) attack.

Recently, it was shown by Curty and Lutkenhaus [Phys. Rev. A 69, 042321 (2004)] that the PNS attack is not always the optimal attack when two photons are present: if errors are present in the correlations Alice-Bob and if Eve cannot modify Bob's detection efficiency, Eve gains a larger amount of information using another attack based on a 2->3 cloning machine.

In this work, we extend this analysis to all distances Alice-Bob. We identify a new incoherent 2->3 cloning attack which performs better than those described before. Using it, we confirm that, in the presence of errors, Eve's better strategy uses 2->3 cloning attacks instead of the PNS. However, this improvement is very small for the implementations of the Bennett-Brassard 1984 (BB84) protocol. Thus, the existence of these new attacks is conceptually interesting but basically does not change the value of the security parameters of BB84. The main results are valid both for Poissonian and [...]

NIEDERBERGER, Armand, SCARANI, Valerio, GISIN, Nicolas. Photon-number-splitting versus cloning attacks in practical implementations of the Bennett-Brassard 1984 protocol for quantum cryptography. Physical Review. A , 2005, vol. 71, no. 4

DOI : 10.1103/PhysRevA.71.042316

Available at:

http://archive-ouverte.unige.ch/unige:36751

Disclaimer: layout of this document may differ from the published version.

Photon-number-splitting versus cloning attacks in practical implementations of the Bennett-Brassard 1984 protocol for quantum cryptography

Armand Niederberger,¹ Valerio Scarani,² and Nicolas Gisin²

1Section de Physique, Ecole Polytechinque Fédérale de Lausanne, CH-1015 Ecublens

2Group of Applied Physics, University of Geneva, 20, rue de l’Ecole-de-Médecine, CH-1211 Geneva 4, Switzerland 共Received 26 August 2004; published 11 April 2005兲

In practical quantum cryptography, the source sometimes produces multiphoton pulses, thus enabling the eavesdropper Eve to perform the powerful photon-number-splitting共PNS兲attack. Recently, it was shown by Curty and Lütkenhaus关Phys. Rev. A 69, 042321共2004兲兴that the PNS attack is not always the optimal attack when two photons are present: if errors are present in the correlations Alice-Bob and if Eve cannot modify Bob’s detection efficiency, Eve gains a larger amount of information using another attack based on a 2→3 cloning machine. In this work, we extend this analysis to all distances Alice-Bob. We identify a new incoherent 2→3 cloning attack which performs better than those described before. Using it, we confirm that, in the presence of errors, Eve’s better strategy uses 2→3 cloning attacks instead of the PNS. However, this improve- ment is very small for the implementations of the Bennett-Brassard 1984共BB84兲protocol. Thus, the existence of these new attacks is conceptually interesting but basically does not change the value of the security parameters of BB84. The main results are valid both for Poissonian and sub-Poissonian sources.

DOI: 10.1103/PhysRevA.71.042316 PACS number共s兲: 03.67.Dd

I. INTRODUCTION

Quantum cryptography, or more precisely quantum key distribution共QKD兲is a physically secure method for the dis- tribution of a secret key between two distant partners, Alice and Bob, that share a quantum channel and a classical au- thenticated channel 关1兴. Its security comes from the well- known fact that the measurement of an unknown quantum state modifies the state itself: thus an eavesdropper on the quantum channel, Eve, cannot get information on the key without introducing errors in the correlations between Alice and Bob. In equivalent terms, QKD is secure because of the no-cloning theorem of quantum mechanics: Eve cannot du- plicate the signal and forward a perfect copy to Bob.

However, perfect single-photon sources are never avail- able, and in most practical implementation the source is sim- ply an attenuated laser. This means that some of the pulses traveling from Alice to Bob contain more than one photon.

These items, in the unavoidable presence of losses in the quantum channel, open an important loophole for security:

Eve may perform the so-called photon-number-splitting 共PNS兲attack, consisting of keeping one photon in a quantum memory while forwarding the remaining ones to Bob关2,3兴. This way, Eve has kept a perfect copy without introducing any error. In particular, here we consider the BB84 QKD protocol introduced by Bennett and Brassard in 1984关4兴. In this protocol, when the basis is revealed in the sifting phase Eve can measure each photon that she has kept in the good basis and obtain full information on the bit.

Until recently, it was thought that this attack was the best Eve could do when two or more photons are present. How- ever, in a recent work关5兴, Curty and Lütkenhaus共CL兲have shown that this is not the case for noisy lines共optical visibil- ity V⬍1兲 and imperfect detectors 共quantum efficiency ␩^, dark count probability p_d兲, when the natural assumption is made that Eve cannot modify the detectors’ parameters. Ba-

sically, the idea is simple: consider pulses that contain two photons. In the PNS attack, Eve has full information after the basis announcement provided Bob has detected the photon that was sent. So, in the information balance, Eve’s informa- tion for such an item is␩⫻1. Suppose now that Eve, instead of performing the PNS, uses a suitable 2→3 cloning ma- chine, keeps one photon and forwards the other two photons to Bob. Eve’s information conditioned to Bob’s detection could be I_c2艋1, but now the probability that Bob detects a photon of the pulse is关1 −共1 −␩兲²兴. Thus for small values of

␩, Eve’s information for a two-photon pulse becomes 2␩

⫻I_c2, and this may be larger than ␩. Of course, by using such a cloner, Eve introduces some errors, so this attack is possible only up to the expected quantum bit error rate 共QBER兲.

As we prove below however, the analysis of CL is re- stricted to a specific distance of the line Alice-Bob, which turns out to be unrealistically short. The goal of this paper is to evaluate the contribution of the individual attacks that use 2→3 cloning machines for all distances in a realistic range of parameters. When this is done, the contribution of attacks using 2→3 cloning machines leads to a negligible improve- ment over the usual PNS strategies: both the achievable secret-key rate and the maximal distance are for all practical purpose the same, whether these new attacks are used or not.

This is our main result. In the run, we describe a different strategy that uses a 2→3 cloning machines, that performs better than those previously described. This strategy has an intuitive explanation which opens the possibility of immedi- ate generalizations: in particular, it may prove useful to study the security of other protocols, against which the PNS at- tacks are less effective关6–8兴.

The paper is constructed as follows. In Sec. II, we state our hypotheses precisely and write down general formulas, in which Eve’s attack is parametrized by the probabilities of performing each strategy, and submitted to some constraints.

PHYSICAL REVIEW A 71, 042316共2005兲

1050-2947/2005/71共4兲/042316共10兲/$23.00 042316-1 ©2005 The American Physical Society

At the end of this section, we show that the analysis of CL, correct though it is, is valid only for a given distance be- tween Alice and Bob, whence the need for the present exten- sion of their work. Section III contains the main results: we perform numerical optimization assuming the two known 2

→3 cloning strategies and our new one, showing that ours performs indeed better but that its contribution is on the whole negligible. Section IV is devoted to some extensions and remarks. Finally, in Sec. V, we give some semianalytical formulas that reproduce the full numerical optimization to a satisfactory degree of accuracy: these are useful for experi- mentalists, to find bounds for the performance of their set- ups. Section VI is a conclusion.

II. HYPOTHESES AND GENERAL FORMULAS A. Imperfect source, line, and detectors

We are concerned with practical quantum cryptography, so the first point is to describe the limitations on Alice’s and Bob’s hardware. We work in a prepare-and-measure scheme.

Alice’s source. Alice encodes her classical bits in light pulses; the number of photons in each pulse is distributed according to a probability law p_A共n兲. In most practical QKD setups, Alice’s source is an attenuated laser pulse, so p_A共n兲

= p共n兩␮兲the Poissonian distribution of mean photon number

␮. But our general formulae and most of our results will be valid independently of the distribution, so in particular they apply to all quasi-single-photon sources 关9兴. For heralded single-photons obtained from an entangled pair关10兴, the situ- ation is more complex. If the twin photon is used only as a trigger, and the preparation of the state is done directly on the photon共s兲traveling to Bob, then this source behaves ex- actly as a sub-Poissonian source, and our subsequent analysis applies. If on the contrary the twin photon is used also for the preparation 共because one detects its polarization state, thus preparing at a distance the state of the photon traveling to Bob兲, then the PNS attack is not relevant关1,3兴.

Alice-Bob quantum channel. The quantum channel which connects Alice and Bob is characterized by the losses ␣^, usually given in dB/km 共for optical fibers at the telecom wavelength 1550 nm, the typical value is␣⯝0.25 dB/ km兲. The transmission of the line at a distance d is therefore

t = 10^−␣d/10. 共1兲 Moreover, we take into account nonperfect visibility V of the interference fringes.

Bob’s detector. It has a limited quantum efficiency␩^and a probability of dark count per gate p_d. The gate here means that Bob knows when a pulse sent by Alice is supposed to arrive, and opens his detector only at those times; so here,

“per关Bob’s兴gate” and “per关Alice’s兴pulse” are equivalent.

Those two parameters are not uncorrelated: in reverse-biased avalanche photodiodes, a larger bias voltage increases both␩ and p_d. Typical values nowadays are␩= 0.1 and p_d= 10⁻⁵.

B. Alice and Bob’s rates and information

We write p_B共0兲the probability per pulse that Bob detects no photon sent by Alice. Since both losses in the line and detection are binomial processes

p_B共0兲=

兺

n

p_A共n兲共1 − t␩兲ⁿ; 共2兲 for a Poissonian distribution on Alice’s side, p_B共0兲

= p共0兩␮^t␩兲. We consider only those cases in which Alice and Bob use the same basis, because in any case the other items will be discarded during the sifting phase. Bob’s count rates per pulse in the “right” and the “wrong” detector are then given by关11兴

C_right=1

2

冋

^{关1 − pB共0兲兴}

冉

^{1 + V2}

冊

^{+ pB共0兲pd}

册

^{, 共3兲}

C_wrong=1

2

冋

^{关1 − pB共0兲兴}

冉

^{1 − V2}

冊

^{+ pB共0兲pd}

册

^{, 共4兲}

where the factor ¹₂ accounts for the losses in the sifting phase. The QBER is the fraction of wrong bits accepted by Bob,

Q = C_wrong

C_right+ C_wrong=1

2− V

2

冉

^{1 +2p1 − pdpB}B^共共⁰0^兲兲

冊

^{. 共5兲}

In particular, as long as 关1 − p_B共0兲兴Ⰷp_B共0兲p_d, one can ne- glect C_wrong in the denominator and decompose Q = Q_opt + Q_det, with the optical QBER defined as Q_opt=共1 − V兲/ 2. The mutual information Alice-Bob after sifting is

I共A:B兲=共C_right+ C_wrong兲关1 − H共Q兲兴, 共6兲 where H is Shannon entropy.

C. Hypotheses on Eve’s attacks

Hypothesis 1. The characteristics of the quantum channel 共the optical QBER, or more precisely V, and the losses, that determine the transmission t兲are fully attributed to Eve. On the contrary, Eve has no access to Bob’s detector:␩ ^{and p}d

are given parameters for both Bob and Eve. The eavesdrop- per will of course adapt her strategy to the value of these parameters, but she cannot play with them. This hypothesis is almost unanimously accepted as reasonable; it implies that Bob monitors the rate of double clicks when he happened to measure in the wrong basis; if this rate is larger than ex- pected, he aborts the protocol. As realized by CL关5兴, it is precisely this hypothesis that opens the possibility for the cloning attacks to perform better than the PNS关12兴.

Hypothesis 2. Through her PNS attacks, Eve should not modify Bob’s expected count rate due to Alice’s photons C_ph=¹₂关1 − p_B共0兲兴. This constraint is usually assumed in the study of PNS attacks, see, e.g., Refs. 关2,3,5–7兴; still, two comments are needed. One could strengthen the constraint by requiring Eve to reproduce the full photon-number statis- tics at Bob’s side. But one could weaken it as well: here, we are asking that Bob should not notice PNS attacks at all; Eve could be allowed to perform noticeable PNS attacks, in which case one should bound her information and study the possibility of privacy amplification.

Hypothesis 3. Eve performs incoherent attacks: she at-

tacks each pulse individually, and measures her quantum sys- tems just after the sifting phase. The justification for this strong hypothesis is related to the state-of-the-art of the re- search in quantum cryptography: no one has found yet an explicit coherent attacks that performs better than the inco- herent ones关13兴. In other words, incoherent attacks are still used to compute upper bounds for security, while “uncondi- tional security” proofs provide lower bounds关14兴, and for all protocols there is an open gap between the two bounds. Note also that incoherent attacks are not “realistic” in the sense of those described, e.g., in Ref. 关15兴; in particular, Eve is al- lowed to store quantum information in a quantum memory.

The hypothesis of incoherent attacks implies in particular that after sifting, Alice, Bob, and Eve share several indepen- dent realizations of a random variable distributed according to a classical probability law. Under this assumption and the assumption of one-way error correction and privacy amplifi- cation, the Csiszar-Körner bound applies 关16兴: one can achieve a secret-key rate given by

S = I共A:B兲− I共A:E兲. 共7兲 Actually, this is a conservative assumption: in the presence of dark counts, I共B : E兲⬍I共A : E兲holds, so the strict bound for S is I共A : B兲− I共B : E兲; however, the difference is small, and I共A : E兲 is easier to estimate. We devote Sec. IV C below to comments about I共B : E兲. The mutual information I共A : B兲has been given in Eq.共6兲, we should now provide an expression for I共A : E兲.

D. Eve’s strategies

Having stated the hypotheses on Eve’s attacks, we can now formulate Eve’s strategy as a function of some param- eters. We suppose that the first thing Eve does, just outside Alice’s lab, is a nondestructive measurement of the photon number. Sometimes, she will simply find n = 0 and there is nothing more to do. When n⬎0, she will choose some at- tacks with the suitable probabilities. We have attributed all the losses in the line to Eve: this means that Eve replaces the quantum channel with a lossless line, and takes advantage of the losses to keep in a quantum memory or simply block some photons.

Strategy for n = 1. When Eve finds one photon, with some probability p_c1she applies the well-known optimal incoher- ent attack 关17兴, that consists in 共i兲 applying the optimal asymmetric phase-covariant cloning machine 关18兴, 共ii兲 for- warding the original photon to Bob while keeping the clone and the ancilla in a quantum memory,共iii兲make the suitable measurement as soon as the basis is revealed. This strategy contributes to Bob’s detection rate with

R₁=1

2␩^pA共1兲p_c1, 共8兲 where the factor ¹₂␩ is due to the fact that Bob must accept the item共detect the photon and accept at sifting兲. On these items, Eve introduces a disturbance D₁ and gains the infor- mation I₁共D₁兲= 1 − H共P₁兲 with P₁=¹₂+

冑

^D1共1 − D₁兲. With probability p_b1= 1 − p_c1, Eve simply blocks the photon—in

principle, one can define the probability p_l1 that Eve leaves the photon fly to Bob without doing anything, but this is not useful for her 共we left this parameter free in our numerical simulations, see Sec. III, and verified that one indeed finds always p_l1= 0兲.

Strategy for n = 2. Sometimes, Eve finds two photons. The standard PNS strategy is a storage attack: Eve keeps one photon in a quantum memory, and forwards the other one to Bob. Eve applies the storage attack with probability p_s2. This strategy contributes to Bob’s detection rate with

R_2s= 1

2␩^pA共2兲p_s2; 共9兲 on these items, Eve introduces no disturbance D₁and gains the information I_s2= 1. As stressed in the Introduction, the main theme of this work is CL’s observation that the storage attack may not always be the best Eve can do on two pho- tons. With probability p_c2, she rather uses a 2→3 asymmet- ric cloning machine, keeps the clone and the ancillae and forwards the two original photons, now slightly perturbed, to Bob. This strategy contributes to Bob’s detection rate with

R_2c=1

2关1 −共1 −␩兲²兴p_A共2兲p_c2; 共10兲 on these items, Eve introduces a disturbance D₂and gains an information I₂共D₂兲that depends on the cloning machine that is used. Finally, one can in principle define the probability of blocking both photons p_b2; but this turns out to be always zero in practice共as for p_l1, we used this as a free parameter in the numerical simulations兲. The reason is the following. If Eve could reproduce Bob’s detection rate by blocking all the n = 1 items共in which case, she might have to block also some of the n = 2 items兲, she would have full information. Alice will then choose her probabilities p_A共n兲 in such a way that this is not the case: Eve must be forced to forward some items with n = 1. Now, Eve gains more information on the n = 2 than on the n = 1 items: therefore, she had better use all the losses to block as much n = 1 items as possible; but then, she cannot block any n = 2 item. Thus p_b2= 0 and p_c2= 1

− p_s2.

Strategy for n艌3. If Eve finds more than two photons, we suppose that she performs always the storage attack: she keeps one photon and forwards the remaining n − 1 photons to Bob. This strategy contributes to Bob’s detection rate with

R₃=1

2_n

兺

_艌3^{关1 −共1 −␩兲n−1兴pA共n兲; 共11兲}

on these items, Eve introduces no disturbance and gains full information. This is not always optimal: unambiguous dis- crimination strategies 关6,7兴 or cloning attacks 关5兴 may give Eve more information. However, we do not discuss the full optimization because in any case the contribution of items where n⬎2 to the total information is small, as will be clear below. Note also that in a storage attack Eve systematically removes one photon; at very short distances, this might not be possible because the expected losses in the line Alice-Bob are not large enough. To avoid any surprise, we shall start all our numerical optimization at a distance d = 10 km, where

PHOTON-NUMBER-SPLITTING VERSUS CLONING… PHYSICAL REVIEW A 71, 042316共2005兲

042316-3

the losses are definitely large enough to allow storage attack on all items with n艌3关19兴.

Summary. We allow different attacks with different prob- abilities, conditioned on the knowledge of the number of photons present in each pulse. Apart from the hypotheses made on R₃, this represents the most general incoherent at- tack on the BB84 protocol—provided the hardware is pro- tected against “realistic attacks” such as Trojan horses, faked states, etc.关21兴, as we suppose it to be.

E. Formulas for Eve’s attack

We can now group everything together and describe the formulas that will be used for Eve’s attack. Eve’s informa- tion on Bob’s bits reads关20兴

I共A:E兲= R₁I₁共D₁兲+ R_2s+ R_2cI₂共D₂兲+ R₃, 共12兲 where

I₁共D₁兲= 1 − H

冉

¹²⁺

^冑

^{D1共1 − D1兲}

冊

^共13兲

and where I₂共D₂兲is the information gained by Eve using a 2→3 asymmetric cloning machine, for which the optimal is not known共see next section兲. For a given probability distri- bution used by Alice p_A共n兲, Eve chooses the four parameters p_c1, p_c2, D₁, and D₂in order to maximize Eq.共12兲, submitted to the constraints that determine t and V. The constraint on t guarantees that the losses introduced by Eve must be those expected on the quantum channel, so in particular that Bob’s detection rate is unchanged:

R₁+ R_2s+ R_2c+ R₃=1

2关1 − p_B共0兲兴. 共14兲 Alice and Bob have to choose their source in order to ensure that Eve cannot set R₁= 0, otherwise she has full information by simply using the PNS. This is the reason why the contri- bution of R₃is small: the leading term is a fraction of p_A共1兲, typically of the order of p_A共2兲. Now, p_A共3兲/ p_A共2兲= O共␮兲

⬃0.1 for the usual Poissonian source, and even smaller for sub-Poissonian ones. The constraint on V guarantees that the error rate introduced by Eve must sum up to the observed optical QBER, that is,

R₁D₁+ R_2cD₂=1

2关1 − p_B共0兲兴

冉

^{1 − V2}

冊

^{. 共15兲}

In the next section, we discuss a good choice of I₂共D₂兲, then perform numerically the optimization of Eve’s strategies over the four parameters p_c1, p_c2, D₁, and D₂. Before this, we are now able to pinpoint the limitations of the analysis of CL.

F. The limitation in CL

In our notations, the parameter p that characterizes Alice’s source in Ref.关5兴is given by p = p_A共1兲/关1 − p_A共0兲兴, the con- ditional probability of having one photon in a nonempty pulse. Items with more than two photons are neglected, so in our notations R₃= 0 and 1 − p = p_A共2兲/关1 − p_A共0兲兴. This as-

sumption is not critical a priori. What is critical, is the choice of Eve’s attacks that are compared. The PNS attack R_2c= 0 is compared to a cloning attack in which not only R_2s, but also R₁is set to 0. As CL correctly note, the comparison is fair only if the counting rates are the same between the two strategies, which reads here R₁^PNS+ R_2s^PNS= R_2c^clon; in turn, this condition determines p = 1 /共2 −␩兲. Now, Alice should adapt the parameters of her probability distribution as a function of the distance of the quantum channel. Thus, a given value of p will be optimal only for a given distance共or at best, for a small range of possible distances兲: the fact of setting R₁= 0 in the cloning attack limits the validity of CL’s analysis to a given length of the line Alice-Bob.

In particular, if we consider that p_A共n兲 is a Poissonian distribution, then 共1 − p兲/ p = p共2兩␮兲/ p共1兩␮兲=␮/ 2; setting p

= 1 /共2 −␩兲 leads to ␮^{= 2 /}共1 −␩兲艌2. This is a very large value of␮, that consequently can be used only at a very short distance.

III. MAIN RESULTS

The problem that we want to solve involves a double optimization. For any given distance, Alice should choose the parameters of her source 共e.g., for a Poissonian source, the mean number of photons per pulse兲 in such a way as to optimize the secret key rate S, Eq.共7兲. This quantity must be computed for Eve’s best strategy, i.e., for I共A : E兲as large as possible: so, for any choice of Alice’s parameters, we must find the values of p_c1, p_c2, D₁, and D₂that maximize Eq.共12兲 under the constraints共14兲and共15兲. For this task, numerical algorithms are the reasonable choice. But, as an input for these algorithms, we need the explicit form of I₂共D₂兲. We devote the next paragraph to this point.

A. The choice of the 2\3 cloning attack

Eve receives two photons in the state兩␺典^丢2, where 兩␺典is one of the four states used in BB84. She has these photons interact with a probe of hers, then she forwards two photons to Bob, having introduced an average disturbance D₂. By measuring her probe after the sifting phase, Eve gains an information I₂共D₂兲 on the state prepared by Alice. Finding the optimal attacks means finding the best unitary transfor- mation, the best probe and the best measurement on it, such that I₂共D₂兲 is maximal for any given value of D₂. Though well defined, this problem is very hard to solve in general.

Let us restrict to attacks where the photons flying to Bob after the interaction are in a symmetric state, so that the transformation reads

兩k典兩E典→

兺

k⬘⁼¹

3

c_k^k⬘兩k⬘^典兩Ek

k⬘典, 共16兲

where兩k典is a basis of the symmetric subspace of two qubits.

There are nine vectors兩E_k^k⬘典, so Eve’s probe must be at least nine-dimensional to avoid loss of generality. In addition, the measurement that gives Eve the best guess on the state sent by Alice is not known in general. In summary, finding the optimal I₂共D₂兲in full generality amounts to solving an opti-

mization over more than hundred real parameters, for an un- defined figure of merit. We give this up and try a different approach, namely to guess a good 共if not the optimal兲 2

→3 cloning attack.

Let us first look at what is already known. Two asymmet- ric 2→3 cloning machines were proposed in Ref.关7兴; Curty and Lütkenhaus 关5兴 based their analysis of 2→3 cloning attacks on those. The first machine共cloner A兲is a universal asymmetric cloner, recently proven to be optimal in terms of fidelity 关22兴. For a disturbance D₂ introduced on Bob’s states, this machine gives Eve an information关5兴

I₂^A共D₂兲= 2D₂+共1 − 2D₂兲关1 − H共P₂兲兴 共17兲 with P₂=¹₂共

冑

^8D2共1 − 4D₂兲兲/共1 − 2D₂兲. A particularly interest- ing feature is that I₂^A共D₂= 1 / 6兲= 1. This sounds at first aston- ishing, because one is used to Eve’s getting full information only by breaking all correlations between Alice and Bob. But this is the case only if Eve receives a single photon from Alice. Here Eve receives two photons in the same state. In fact, the result I₂^A共D₂= 1 / 6兲= 1 is not only reasonable, but it can be reached by a much simpler strategy: Eve just keeps one of the two incoming photons 共so, after sifting, she can get full information兲and duplicates the second one using the optimal symmetric 1→2 cloner of Bužek-Hillery关23兴, which makes copies with fidelity ⁵₆, whence D₂=¹₆.

Cloner A is good共and we conjecture it to be optimal兲to attack two-photon pulses in the six-state protocol 关24兴, be- cause of its symmetry. However, here we are dealing with BB84: for the one-photon case, it is known that one can do better than using the universal asymmetric cloner. In fact, the optimal incoherent attack on single-photon pulses uses the phase-covariant cloning machine, that copies at best two maximally conjugated bases out of 3关18兴. So we suspect that also for the 2→3 cloning attack, we should rather look for an asymmetric 2→3 phase-covariant cloner. The second cloner共cloner B兲described in Ref.关7兴is an example of such a cloner. However, it has some unpleasant features: on the one hand, in terms of fidelity it is slightly suboptimal for the parameter that defines symmetric cloning关25兴; more impor- tant, I₂^B共D₂兲⬍1 for all values of D₂—we do not write I₂^B共D₂兲 explicitly, because it is quite complicated and after all unim- portant for the present work; see Ref.关5兴.

In summary, two 2→3 asymmetric cloning machines have been discussed in the literature, but they are suboptimal for our task. Still, in the sake of comparison with Ref. 关5兴, we ran our first numerical optimizations using I₂^A共D₂兲, then I₂^B共D₂兲. The result is striking: 共i兲 if I₂= I₂^A, then the optimal strategy is always obtained for D₂=¹₆, whatever the values of the other parameters;共ii兲if I₂= I₂^B, the optimal strategy is the one that uses no 2→3 cloning attack共p_c2= 0兲. Following this observation, it is natural to emit the following conjecture: the 2→3 cloner is always used for the value of D₂that gives

I₂共D₂兲= 1. 共18兲 Under this conjecture, we can then replace I₂共D₂兲by 1 in Eq.

共12兲, and we have to find the lowest value of D₂for which Eq. 共18兲 holds. In general, this is a task of the same com- plexity as optimizing Eve’s strategy for all values of D₂; but

we can at least construct a very simple strategy which has an intuitive interpretation, and which performs better than the ones which use cloners A and B.

Hypothesis 4. The strategy for the 2→3 cloning attack is the following: out of two photons sent by Alice, Eve keeps one and sends the other one into the optimal symmetric 1

→2 phase-covariant cloner. This provides Eve with I₂共D₂兲

= 1 after sifting, and Bob receives two photons with a distur- bance

D₂=1

2

冉

^{1 −}

冑

¹²

冊

^{, 共19兲}

that is,⯝0.1464关18兴. Since this disturbance is smaller than

1

6, for any fixed value of V Eve can use the 2→3 cloning attack more often than in the optimized version of the attack using cloner A, see constraint 共15兲. That is why our new attack performs better. Moreover, the attack has an intuitive form, that can be generalized: in particular, it seems natural to extend the conjecture to attacks on n⬎2 photons, al- though here we do not consider this extension because these cases are rare共see above兲. In what follows, we comment on the explicit results that we find for the numerical optimiza- tion using this strategy.

B. Numerical optimization for Poissonian sources We use numerical optimization to find, under hypotheses 1–4, Eve’s best strategy and the optimal value of Alice’s parameters共see Fig. 1兲. We consider a Poissonian distribu- tion for Alice’s source

p_A共n兲 ⬅p共n兩␮兲= e^−␮␮ⁿ

n! 共20兲

so that the only parameter that characterizes Alice’s source is the mean number of photons ␮ 共see Sec. IV A below for extension to sub-Poissonian sources兲. As sketched above, the numerical optimization is done as follows. For any value of the distance d Alice-Bob, we choose a value of␮ ^{and find} the values of p_c1, p_c2, and D₁that optimize Eve’s information FIG. 1. Illustrating the conjecture on Eve’s 2→3 cloning strat- egies: the asymmetric 2→3 cloning machine A共2 , 3兲 is actually used at a working point where Eve keeps a perfect copy and for- wards two identically perturbed photons to Bob, produced with the symmetric 1→2 cloning machine S共1 , 2兲.

PHOTON-NUMBER-SPLITTING VERSUS CLONING… PHYSICAL REVIEW A 71, 042316共2005兲

042316-5

under the constraints. This gives a value for the secret key rate S. Then we vary␮ and repeat the procedure, until the highest value of S is found. This defines the optimal value of

␮^.

We have done these calculations for the nowadays stan- dard 共and even conservative兲 values ␣= 0.25 dB/ km, ␩

= 0.1 and p_d= 10⁻⁵. Of course, the qualitative features are independent of these precise values.

The achievable secret key rate S, Eq.共7兲, is plotted in Fig.

2 as a function of the distance, in log scale. The full lines are obtained by allowing Eve to use our new 2→3 cloning at- tack defined above. Supposing this attack we can extract, at any distance, an optimal value of␮: this is the mean number of photons Alice and Bob should choose. For the so- computed␮, we then compute S by supposing two subopti- mal attacks by Eve, namely, no 2→3 cloning, and 2→3 cloning with cloner A关5兴. The results of these suboptimal attacks are plotted in the discontinuous lines. We see that indeed our strategy yields the best results for Eve共the small- est S achievable兲, but the difference between the optimal and the suboptimal attacks is very small—in fact, under the as- sumptions of practical cryptography this difference is com- pletely negligible, see beginning of Sec. V.

Figures 3 and 4 illustrate in detail the parameters for Eve’s optimal attack, for a fixed distance共30 km兲, as a func- tion of the visibility V. In Fig. 3 are plotted the probabilities introduced in Sec. II D that define Eve’s strategies on the pulses with n = 1 共lower half of the figure兲 and with n = 2 共upper half兲. Figure 4 represents the four terms that sum up to Eve’s information 共12兲. Much information is stored in these graphics.

First note that at Vⱗ0.74, that is Q_optⲏ13%, one has I共A : E兲= I共A : B兲 so S = 0. For smaller values of the visibility, with our assumptions on the attacks and on the numerical

values of the parameters, the BB84 protocol becomes inse- cure for all␮at 30 km. This is due to the characteristics of the source: recall that for incoherent attacks on the BB84 protocol with perfect single-photon sources, the critical vis- ibility is Vⱗ0.7共Q_opt艌14.67%兲independent of the distance 关1,17兴.

For V = 1, Eve is not allowed to introduce any error.

Therefore, for n = 1 she can either block or forward the pulse without introducing any error共D₁= 0兲, and she gains no in- formation; for n = 2, she can only perform the storage attack.

As soon as V⬍1, Eve’s strategy on the one-photon pulses does not change, while on the two-photon pulses she starts using the cloning strategy. She uses it on as many pulses as possible, compatible with constraint共15兲. This situation goes on until V⯝0.88: for that visibility, Eve can perform the 2

→3 cloning attack on all the two-photon pulses. Then, for Vⱗ0.88, Eve can start introducing errors共and gaining some information兲 on one-photon pulses as well; and indeed, we see the increase of D₁ in Fig. 3 and the corresponding in- crease of I_c1in Fig. 4.

In the region 0.88ⱗV⬍1, we note an ambiguity of the simulation for the single-photon pulses. In fact 共Fig. 3兲we have p_c1⬎0 but D₁= 0, so this “cloning” actually amounts to FIG. 2. Secret key rate per pulse S as a function of the distance,

for ␣= 0.25 dB/ km, ␩^{= 0.1, and p}d= 10⁻⁵, and for V

= 1 , 0.95, 0.9, 0.85, 0.8. The best attack共full line兲uses strategy C for 2→3 cloning; the value of the optimal␮is fixed by this strategy.

For comparison, we plot the results that one would obtain using strategy A for 2→3 cloning 共dashed lines兲 and without using any 2→3 cloning共dashed-dotted lines兲, computed for the same␮.

FIG. 3. Probabilities that define Eve’s optimal attack as a func- tion of the visibility, for d = 30 km, for the optimal␮. In the lower half one reads the probabilities for the attacks on n = 1; in the upper half, for n = 2. The white symbols represent D₁共lower half兲and D₂ 共upper half兲. Note that high visibility共small optical errors兲are on the left. See text for detailed comment.

FIG. 4. The four terms that sum up to Eve’s information共12兲as a function of the visibility, for d = 30 km and for the optimal␮. Eve’s information is divided by the value of I共A : B兲at any V. See text for detailed comments.

leaving photons undisturbed and might as well be accounted for through p_l1. Recall that in Sec. II D we said that one can always set p_l1= 0; it is now clear why: as long as D₁= 0, letting it pass is equivalent to cloning and we see that when D₁becomes larger than 0, cloning is applied on all the for- warded photons so that indeed p_l1= 0.

There is a slight discontinuity in Eve’s information, vis- ible in Fig. 4, at the point where Eve starts to use the cloning strategy on the single-photon pulses. We ran more detailed simulations in order to rule out the possibility that this is an artefact. It appears that this discontinuity is a direct conse- quence of a discontinuous modification of␮: for that value of the parameters, Alice and Bob should decrease␮^slightly more than expected by continuity.

At the end of this discussion, one might reasonably raise a doubt. We have just seen that the 2→3 cloning machine is used as soon as V⬍1, and that for some rather high visibility 共V⬇0.88 at d = 30 km兲 it is used on all the two-photon pulses. Why then is its effect so negligible in comparison to the case when this machine is not used, as we saw in Fig. 2?

The reason is that Figs. 3 and 4 would look fundamentally different if the 2→3 cloning machine is not used. If Eve performs the storage attack instead of the cloning attack on the two-photon pulses, then she can introduce errors, and consequently gain information, on the single-photon pulses:

we would have D₁⬎0 and I_c1⬎0 as soon as V⬍1, not only for Vⱗ0.88. It turns out that all the information, that Eve loses on the two-photon pulses by not using the cloning at- tack, is almost exactly compensated by the information that she gains on the single-photon pulses. This casts a new light on the result of Fig. 2: the difference between the optimal and the suboptimal strategies is small, not because the 2

→3 cloning is rarely used, but because the constraints 共14兲 and共15兲 imply that using the 2→3 cloning attack on n = 2 reduces the possibility of using the 1→2 cloning attack on n = 1.

IV. EXTENSIONS AND REMARKS A. Extension to sub-Poissonian sources

For the numerical optimization, we have supposed the Poissonian distribution for the number of photons produced by Alice, because this is the most frequent case in practical implementations. However, sub-Poissonian sources are being developed for quantum cryptography 关9兴. The main result, namely, that 2→3 cloning attacks contribute with a very small correction to Eve’s information, remains valid for these sources: the fraction of pulses with n = 2 photon is even smaller than in the Poissonian case, so the contribution of the 2→3 cloning attack will be even more negligible—actually, it is even possible that, for a sufficiently large deviation from the Poissonian behavior, this kind of attack does not help at all.

B. Extension to other protocols

One might ask how our study applies to other protocols.

In the last months, practical QKD has witnessed great progress: several ideas have been put forward that make the

PNS attacks less effective by modifying the hardware关8兴, the classical encoding 关6,7兴 or the quantum encoding 关26兴. Of course, even if the PNS can never be used by Eve, multipho- ton pulses open the possibility for elaborated cloning attacks:

these must be taken into account when assessing the security of new protocols.

C. About reverse reconciliation

In Sec. II, when defining S in Eq.共7兲, we mentioned the fact that I共B : E兲is slightly smaller than I共A : E兲here, so that Alice and Bob would better do “reverse reconciliation”关27兴. In this paragraph, we want to elaborate a little more on this point.

The first cause of the relation I共B : E兲⬍I共A : E兲is the pres- ence of dark counts: when Bob accepts an item, Eve共as well as Bob himself兲does not know if his detector fired because of the photon that she has forwarded共and on which she has some information兲or because of a dark count共on which she has no information兲. It is easy to take this effect into account.

Suppose that Eve forwards n photons to Bob. Conditioned to this knowledge, Bob’s detection rate reads r_n= r_ph+ r_dark where r_ph=关1 −共1 −␩兲ⁿ兴and r_dark= p_d共1 −␩兲ⁿ. Thus, to obtain I共B : E兲, the n-photon contribution to formula共12兲should be multiplied by a factor关1 − H共⑀n兲兴, where ⑀n= r_dark/ r_n. Now,

⑀1⯝p_d/␩^{, and} ⑀n艌2⬍⑀1; so all these corrections are really negligible.

The second contribution is much less easily estimated: it comes from the 2→3 cloning machines. The formulae we used for strategies A and B, derived by CL关5兴, refer to the mutual information Alice-Eve. In strategy C, that looks op- timal when I共A : E兲is optimized, Eve’s information on Bob’s result is smaller than 1 because she does not know determin- istically whether Bob will obtain the same bit as Alice or the wrong bit. This study would require some more work. We do not think this work is worthwhile, after seeing how small the correction introduced on the final values of␮and S by tak- ing the 2→3 cloning attack into account’s.

V. ANALYTICAL FORMULAS FOR RAPID ESTIMATES A. Further simplifying assumptions

As mentioned before, the goal of this section is to provide some simple formulas that allow a good estimate of the im- portant parameters 共optimal mean number of photons, ex- pected secret key rate S, maximum distance兲for implemen- tations of the BB84 protocol, without resorting to the full numerical optimization. Indeed, for practical implementa- tions, absolute precision of these calculations is not required:

on the one hand, existing algorithms for error correction 共EC兲and privacy amplification 共PA兲 reach up to some 80%

of the attainable S; on the other hand, nobody is going to operate his cryptosystem too close to the critical distance. So in short, what one needs is 共i兲 an estimate of the critical distance in order to keep away from it,共ii兲an estimate of the optimal mean number of photons per pulse in order to cali- brate the source, and共iii兲an estimate of the secret-key rate 共of Eve’s information兲in order to choose the parameters for EC+ PA. Note that similar formulae have been found by Lüt-

PHOTON-NUMBER-SPLITTING VERSUS CLONING… PHYSICAL REVIEW A 71, 042316共2005兲

042316-7

kenhaus 关3兴; in that work, however, Eve was supposed to have an influence on all the sources of inefficiency, in par- ticular the parameters of the detector. This is why we cannot simply refer to Lütkenhaus’ results here.

Thus, for this analysis, we make two further simplifying assumptions on Eve’s attack.

共1兲We completely neglect the contribution of the pulses with n艌3 photons. Since we are interested in sources where the mean number of photons␮ is significantly smaller than 1, we have

p_A共1兲=␮^{, p}A共2兲= g₂␮²

2 , 共21兲

whence, in particular, 1 − p_B共0兲⬇␮^t␩. The factor g₂is 1 for a Poissonian source, smaller than 1 for sub-Poissonian sources.

共2兲 For n = 2, we neglect the 2→3 cloning attack and focus only on storage attacks, that is, p_2s= 1. In fact, we have seen that the cloning attack plays a non-negligible role only for V⬇0.8; but this means an optical QBER of 10%, which is enormous and would lead to the failure of the EC+ PA algorithms. For practical cryptography, Vⲏ0.9 is required, and in this region the correction due to cloning 2→3 is really negligible.

B. S as a function of␮alone

Using the Poissonian distribution共20兲, the mutual infor- mation Alice-Bob共6兲reads

I共A:B兲=1

2共␮^t␩^{+ 2p}d兲关1 − H共Q兲兴 共22兲 with the QBER

Q =1

2− V

2

冉

^{1 +}␮^2pt␩^d

冊

^{. 共23兲}

Using our assumptions R_2c= R₃= 0, the first constraint 共14兲 that Eve must fulfill reads␮^pc1␩^{+ g}2共␮^{2/ 2}兲␩⁼␮^t␩^{, whence} one can extract

p_c1= t − g₂␮

2. 共24兲

The second constraint共15兲, using R_2c= 0 and the expression we have just found for p_c1, reads ␮关t − g₂共␮^{/ 2}兲兴␩^D1

=␮^t␩关共1 − V兲/ 2兴, whence

D₁= 1 − V

2 − g₂␮^{/t. 共25兲} Then, the mutual information Alice-Eve共12兲reads

I共A:E兲=1

2␮␩

冋 ^冉

^{t − g2␮2}

^冊

^{I1共D1兲+ g2␮2}

册

^{, 共26兲}

where we recall that I₁共D₁兲= 1 − H共P₁兲 with P₁=¹₂ +

冑

^D1共1 − D1兲. Presently then, S = I共A : B兲− I共A : E兲 is written as a function S共␮兲of␮alone—in particular, our hypotheses removed two of the four parameters of Eve’s attacks, and

because of the two constraints there are no more free param- eters for Eve. One can then find the optimal␮as a function of the distance, and the corresponding S, by running a nu- merical optimization of S共␮兲. This is already simple enough and gives very accurate results, see Fig. 5. Still, we want to go a few steps forward, to provide less accurate but explicit formulas.

C. Formulas for high visibility and not too long distances To perform analytical optimization, we must get rid of the

␮ dependence in the nonalgebraic functions H共Q兲 and I₁共D₁兲. This can be done for not too long distances, that is when 2p_dⰆ␮^t␩, because then Q⯝Q_opt=共1 − V兲/ 2. More- over, one can easily see that for V = 1, the optimal␮共satis- fying dS / d␮^{= 0}兲is

FIG. 5. Optimal␮and secret key rate per pulse S共log scale兲for Poissonian sources as a function of the distance, for ␣= 0.25, ␩

= 0.1, and p_d= 10⁻⁵, and for V = 1 , 0.9, 0.8. Comparison of the exact results共dashed lines, coming from Fig. 2兲with two approximations.

共I兲Full lines: numerical optimization over␮alone as discussed in paragraph VB.共II兲 Dotted lines: explicit formulas 共29兲 and 共30兲, that cannot be used for V = 0.8. For V = 1, the vertical asymptote is the limiting distance defined by Eq.共33兲.

␮^{= t}

g₂ 共V = 1兲. 共27兲 Therefore, we set this value for ␮ ^{in D}1, so that now D₁

= 1 − V = 2Q_opt also becomes independent of ␮ 关28兴. This gives P₁⬅P =₂¹−

冑

^V共1 − V兲. Under these new assumptions

S共␮兲 ⯝1

2␮␩

冋

^{t关H共P兲− H共Qopt兲兴− g2␮2H共P兲}

册

^{; 共28兲}

the maximum is obtained for dS / d␮= 0, that is,

␮⯝ t

g₂

冉

^{1 −HH共Q}共P^opt兲^兲

冊

^{. 共29兲}

This must be non-negative, so this approximation共in particu- lar here, the approximation␮^{= t / g}2 in D₁兲is valid provided Q_opt⬍P, that is for V⬎0.8; as we discussed in the introduc- tion of this section, this is perfectly consistent with the vis- ibility requirements in practical setups. Inserting Eq. 共29兲 into Eq.共28兲, we find an explicit formula for the secret key rate

S⯝ 1 4␩_g^t2

2

H共P兲

冉

^{1 −HH共Q}共P^opt兲^兲

冊

^{2. 共30兲}

In the limiting case V = 1 −␧ we can set H共P兲= 1 while H共Q_opt兲= H共␧/ 2兲 cannot be neglected because H increases very rapidly for its argument close to zero. Therefore

S⯝1 2␩^t_g^t

2

冉

^{12− H共␧/2兲}

冊

^{共V = 1 −␧兲. 共31兲}

This formula has an intuitive meaning关29兴:¹₂␩^t共t / g₂兲is sim- ply the sifted-key rate; H共␧/ 2兲 is the fraction that must be subtracted in error correction, and a fraction ¹₂ is subtracted in privacy amplification because of the PNS attack关28兴. For distances far from the critical distance, the agreement of both Eqs.共29兲and共30兲with the exact results is again satisfactory 共Fig. 5兲.

D. Exact limiting distance for V = 1

For the value of the limiting distance, we were able to find a closed formula only for the case V = 1. The idea is that␮ decreases very rapidly when approaching the limiting dis-

tance, so that now ␮^t␩Ⰶp_d. The QBER 共23兲 becomes Q

=¹₂−␧ with ␧=␮^t␩^{/ 4p}d 关30兴. Now, it holds 1 − H共¹₂−␧兲

=共2 / ln 2兲␧²+ O共␧⁴兲. Inserting this into Eq.共22兲we obtain I共A:B兲= p_d 1

8 ln 2

冉

^␮ptd^␩

冊

^{2+ O共␮t␩兲3. 共32兲}

On the other hand, I共A : E兲is still given by Eq.共26兲, of course with I₁共D₁兲= 0 since V = 1, so I共A : E兲=¹₄g₂␩␮². The limiting distance is thus defined by imposing I共A : B兲= I共A : E兲, i.e., S = 0, that is, by the attenuation

t_lim=

冑

^{2 ln 2g2p}_␩^{d. 共33兲}

This result is in good agreement with the limiting distance found in the exact calculation, see Fig. 5. The calculation of Eq.共33兲 is easy because␮ drops out of the condition S = 0;

this is no longer the case for V⬍1, which is why the estimate of the limiting distance becomes cumbersome: one has to provide the link between ␮ and t when approaching that distance, different from Eq.共29兲.

VI. CONCLUSION

In conclusion, we have discussed incoherent attacks on the BB84 protocol in the presence of multiphoton pulses that allow both for the photon-number splitting and the 2→3 cloning attacks. We have identified a new efficient 2→3 cloning attack: Eve keeps one of the incoming photons, and sends the other one into the suitable symmetric 1→2 cloner, then forwards the two photons to Bob. The effect of taking the cloning attacks into account is negligible for realistic values of the parameters共in particular, for an optical visibil- ity Vⲏ0.9兲with respect to the PNS attacks. This means that these attacks do not change the security of BB84; however, they may be important when assessing the security of modi- fied protocols aimed at countering the PNS attacks.

ACKNOWLEDGMENTS

A.N. acknowledges the hospitality of the Group of Ap- plied Physics of the University of Geneva, where this work was done, and is grateful to Marc-André Dupertuis共EPFL兲 for acting as internal reporter for his master thesis. This work was supported by the Swiss NCCR “Quantum photonics”

and the European Union Project SECOQC.

关1兴N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod.

Phys. 74, 145共2002兲.

关2兴G. Brassard, N. Lütkenhaus, T. Mor, and B. C. Sanders, Phys.

Rev. Lett. 85, 1330共2000兲.

关3兴N. Lütkenhaus, Phys. Rev. A 61, 052304共2000兲.

关4兴C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing, Bangalore, India 共IEEE, New York, 1984兲, pp.

175–179.

关5兴M. Curty and N. Lütkenhaus, Phys. Rev. A 69, 042321共2004兲.

关6兴V. Scarani, A. Acín, G. Ribordy, and N. Gisin, Phys. Rev. Lett.

92, 057901共2004兲.

关7兴A. Acín, N. Gisin, and V. Scarani, Phys. Rev. A 69, 012309 共2004兲.

关8兴Recently, a number of new protocols have been invented using the notion of “decoy states,” and which are secure against the PNS attacks: W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 共2003兲; H.-K. Lo, X. Ma, and K. Chen, quant-ph/0411004;

X.-B. Wang, quant-ph/0410075; quant-ph/0411047.

关9兴A. Beveratos, R. Brouri, T. Gacoin, A. Villing, J.-P. Poizat, and

PHOTON-NUMBER-SPLITTING VERSUS CLONING… PHYSICAL REVIEW A 71, 042316共2005兲

042316-9

P. Grangier, Phys. Rev. Lett. 89, 187901共2002兲; E. Waks, K.

Inoue, C. Santori, D. Fattal, J. Vuckovic, G. S. Solomon, and Y. Yamamoto, Nature共London兲 420, 762共2002兲; R. Alléaume et al., New J. Phys. 6, 92共2004兲.

关10兴O. Alibart, S. Tanzilli, D. B. Ostrowsky, and P. Baldi, quant- ph/0405075; S. Fasel et al., New J. Phys. 6, 163共2004兲. 关11兴This formula is rigorously correct if 1 − p_B共0兲⬇p_B共1兲; in fact,

if Bob receives two photons, the effect of V⬍1 is to increase slightly the possibility of double count. For the distances that we are going to consider, p_B共1兲Ⰷp_B共2兲indeed holds.

关12兴Recall the intuitive argument given in the introduction: if Eve could set␩= 1 when it is convenient for her, there would be no advantage for her in sending out two photons instead of one, because Bob detects the time anyway.

关13兴We consider only one-way communication protocols for error correction and privacy amplification. For two-way protocols 共“advantage distillation”兲an avantageous coherent strategy has been found共D. Kaszlikowski, J. Y. Lim, L. C. Kwek, B.-G.

Englert, quant-ph/0312172兲, but it has been proved recently that the same result can be achieved by individual attacks and measurements provided Eve waits until the end of the advan- tage distillation procedure共A. Acín et al., quant-ph/0411092兲. 关14兴For the most advanced lower bounds on BB84 with practical devices, see D. Gottesman, H.-K. Lo, N. Lütkenhaus, and J.

Preskill, Quantum Inf. Comput. 4, 325共2004兲. Note, however, that their bounds cannot be compared directly to the ones de- scribed in this paper, since they suppose that Eve has full con- trol over the imperfections of Bob’s detectors.

关15兴S. Félix, N. Gisin, A. Stefanov, and H. Zbinden, J. Mod. Opt.

48, 2009共2001兲; M. Williamson and V. Vedral, ibid. 50, 1989 共2003兲; M. Curty and N. Lütkenhaus, quant-ph/0411041.

关16兴I. Csiszár and J. Körner, IEEE Trans. Inf. Theory IT-24, 339 共1978兲.

关17兴C. A. Fuchs, N. Gisin, R. B. Griffiths, C.-S. Niu, and A. Peres, Phys. Rev. A 56, 1163共1997兲.

关18兴R. B. Griffiths and C.-S. Niu, Phys. Rev. A 56, 1173共1997兲; D. Bruß, M. Cinchetti, G. M. D’Ariano, and C. Macchiavello, ibid. 62, 012302共2000兲.

关19兴This distance of 10 km is a conservative distance, the details depend on the probabilities p_A共n兲. For instance, let us consider Poissonian distribution, and the even stronger condition that Eve can always keep one photon whenever n⬎1. This is pos- sible as soon as p共1兩␮兲␩⁺兺n⬎1p共n兩␮兲关1 −共1 −␩兲ⁿ⁻¹兴, which is

Bob’s rate when Eve forwards all the items n = 1 and keeps always a photon for n⬎1, becomes equal to 1 − p共0兩␮t␩兲, the expected Bob’s rate in the absence of Eve. For ␩艌0.1, the condition holds for any value of ␮ as soon as tⱗ0.7, that means for dⲏ6 km for␣= 0.25 dB/ km.

关20兴We neglect a small contribution to I共A : E兲. In fact, Eve can gain some information on Alice’s bit even from the single- photon pulses that she does not forward to Bob, if Bob has a dark count and accepts the item. This contribution is com- pletely negligible, because it is of the order⬃p_dp_A共1兲, com- pared to R_c1⬃␩^pA共1兲.

关21兴A. Vakhitov, V. Makarov, and D. R. Hjelme, J. Mod. Opt. 48, 2023共2001兲; V. Makarov and D. R. Hjelme, ibid.共to be pub- lished兲.

关22兴S. Iblisdir, A. Acín, N. Gisin, J. Fiurášek, R. Filip, and N. J.

Cerf, quant-ph/0411179.

关23兴V. Bužek and M. Hillery, Phys. Rev. A 54, 1844共1996兲. 关24兴D. Bruß, Phys. Rev. Lett. 81, 3018 共1998兲; H. Bechmann-

Pasquinucci and N. Gisin, Phys. Rev. A 59, 4238共1999兲. 关25兴G. M. D’Ariano and C. Macchiavello, Phys. Rev. A 67,

042306共2003兲.

关26兴Z. D. Walton, A. F. Abouraddy, A. V. Sergienko, B. E. A.

Saleh, and M. C. Teich, Phys. Rev. Lett. 91, 087901共2003兲; J.

C. Boileau, D. Gottesman, R. Laflamme, D. Poulin, and R. W.

Spekkens, ibid. 92, 017901 共2004兲; X.-B. Wang, quant-ph/

0406100.

关27兴F. Grosshans, N. J. Cerf, J. Wenger, R. Tualle-Brouri, and P.

Grangier, Quantum Inf. Comput. 3, 535共2003兲; D. Collins, N.

Gisin, and H. de Riedmatten, quant-ph/0311101.

关28兴Note that the relation D₁= 2Q under these assumptions is per- fectly consistent: indeed, if␮= t / g₂, then p_c1= t / 2: Eve intro- duces errors in half of the transmitted photons. Consequently, she can introduce a double disturbance on these items.

关29兴We thank N. Lütkenhaus for bringing this point to our atten- tion.

关30兴At first sight, the condition Q⬇₂¹seems at odds with the well- known bound of Q = 14.67% for incoherent attacks, beyond which the key distribution becomes insecure关1,17兴. However, there is no contradiction: the bound concerns the optical QBER, that in our case is zero共V = 1兲. The error rate due to dark counts may become larger than 14.67%, since these errors are not useful for Eve.